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DETAILED ACTION 
Specification 

1 . The title of the invention is not descriptive. A new title is required that is clearly indicative 
of the invention to which the claims are directed. 

The following title is suggested: Sample Netflow for network traffic data collection. 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claims 1-5, 9-12,16-19 and 24-26 are rejected under 35 U.S.C. 103(a) as being unpatentable 

over Hegde (U.S. 6,570,875) in view of McKee (U.S. 5,539,659). 

Regarding claims 1, 9 and 16, Hegde'875 discloses a network node (see FIG. 2, 
Multiprotocol Switch 40) for collecting network traffic data having one or more processing 
engines (see FIG. 2, CPU 80) and a memory (see FIG. 2, Shared Memory 90) comprising a 
set of instructions to: 

receive a group of information (see FIG. 2, Input/output ports 50 receive IP 
packet; see col. 4, lines 34-53, see FIG. 7, S30 and S32; see col. 8, lines 250 to col. 9, lines 
390); 

determine whether to process the group of information for network data collection 
(see FIG. 8, S42, S44; see col. 2, lines 65 to col. 3, lines 9; see col. 9, lines 40-55; note that 
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IP header is extracted and determined if the flow (i.e. source and destination) is in the 
flow table for updating/creating the new forwarding information in the flow table 70 
(also see FIG. 5)); 

process the group of information for network data collection if the determination is to 
process the group of information (see FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, lines 
36-44, see col. 11, lines 65 to col. 12, lines 5; note that the new forwarding information is 
created in the flow table when the flow from extracted IP header is not in the flow 
table; also see FIG. 10 for recording/collecting the entries in the flow table); and 

forward the group of information to the destination (see FIG. 8, S46, S50; see col. 3, 
line 4-10, see col. 10, lines 24-32; note that once the flow is identified and the address is 
resolved, the IP packet is forwarded according to the designated flow); 

Hegde'875 does not explicitly disclose collection according to a sample algorithm. 

However, the above-mentioned claimed limitations are taught by McKee'659. In 
particular, McKee'659 teaches network data collection according to a sample algorithm (see 
FIG. 6, a method/algorithm which collects network traffic data (i.e. a monitoring 
system which randomly collects the traffic data from the sample packets, thus, it is a 
sample method); see col. 1, lines 13-24, see col. 2, lines 67 to col. 3, lines 16). 

In view of this, having the system of Hegde'875 and then given the teaching of 
McKee'659, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify the system of Hegde'875, for the purpose of providing a 
network data monitoring and collection method on sample packets, as taught by McKee'659, 
since McKee'659 states the advantages/benefits at col 3, lines 5-39 that it would facilitate the 
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identification of significant data items relevant to management of a network. The motivation 
being that by monitoring and collection data, it can increase the network performance since 
the system is able to collect data regarding the network and path configuration, provisioning, 
routing, forwarding for future use, and to identify any potential problems in the network. 

Regarding claims 2, 10, 17 and 24, Hegde'875 discloses wherein the group of 
information is an IP packet (see FIG. 2, IP packet; see col. 4, lines 34-53, see FIG. 7, S32; 
IP packet see col. 8, lines 250 to col. 9, lines 390). 

Regarding claims 3, 11, 18 and 25, McKee'659 discloses wherein the sample 
algorithm is selected from one of linear, exponential, natural log, burst, and traffic attribute 
(see FIG. 6, a method/algorithm which collects network traffic attributes/data (i.e. a 
monitoring system which randomly collects the traffic data from the sample packets, 
thus, it is a sample method); see col. 1, lines 13-24, see col. 2, lines 67 to col. 3, lines 16). 

In view of this, having the system of Hegde'875 and then given the teaching of 
McKee'659, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify the system of Hegde'875, for the purpose of providing a 
network data monitoring and collection method on sample packets, as taught by McKee'659, 
for the same purpose and motivation as described in claims 1,9,16 and 23. 
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Regarding claims 4, 12, 19 and 26, the combined system of Hegde'875 and 
McKee f 659 discloses wherein forwarding the group of information to the destination as 
described in claims 1,9,16 and 23. 

Hegde'875 further discloses identifying the destination (see FIG, 8, S44, an entry of 
a flow) using a forwarding table (see FIG. 2 and FIG, 5, Flow Table 70" see coL 2, lines 65 
to col. 3, lines 9; see col. 9, lines 40-55; note that IP header is extracted and determined 
if the flow entry is in the flow table); 

if the destination is in the forwarding table (see FIG. 8, S46; the entries in the flow 
table is Yes), automatically forwarding the group of information to the destination (see FIG. 
8, S46; note that the packet is forwarded according to a flow in the flow table at wire 
speed; see col. 3, lines 6-7; col. 9, lines 50-55) and 

otherwise sending the group of information to one or more processing engines to 
determine routing to the destination (see FIG. 8, S56; Forwarded to CPU for processing; 
col. 3, lines 2-6; note that when there is no entry of a flow in the flow table, the packet is 
forwarded to CPU to be processed. See FIG. 9, S88, S90, S94; the CPU determines and 
creates/updates the table with new forwarding information; see FIG. 9, S72, S94; see 
col. 3, lines 3-5,see col. 10, lines 36-44, see col. 11, lines 65 to col. 12, lines 5) and 

forwarding the group of information according to the determined routing (see FIG. 8, 
S46, S50; see col. 3, line 4-10, see col* 10, lines 24-32; note that once the flow is identified 
and the address is resolved, the IP packet is forwarded according to the 
created/updated designated flow). 
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Regarding claim 5, Hegde'875 discloses wherein forwarding the group of 
information to the destination (see FIG- 8, S46; forwarding packet according to the flow 
table) is performed after processing the group of information (see FIG. 8, S40, S42 and S44; 
getting, checking and determining the IP packet for a flow; see coL 9, lines 44-49; note 
that forwarding IP packet according to the designated step is executed after the step of 
processing IP packet for a flow information is performed). 

3. Claim 6, 13 and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Hegde'875 and McKee'659, as applied to claims 1,9 and 16 above, and further in view of 
Dietz (U.S. 6,651,099). 

Regarding claim 6, 13 and 20, Hegde'875 discloses determining if the group of 
information is part of one or more recorded traffic flows (see FIG. 8, S42, S44; see coL 2, 
lines 65 to col. 3, lines 9; see col. 9, lines 40-55; note that IP header is extracted and 
determined if the traffic flow is in the flow table); 

creating a new entry in a table if the group of information is not part of the one or 
more recorded traffic flows (see FIG. 8, S56; Forwarded to CPU for processing; col. 3, 
lines 2-6; note that when there is no entry of a flow in the flow table, the packet is 
forwarded to CPU to be processed. See FIG. 9, S88, S90, S94; the CPU updates the 
table with a new traffic flow; see FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, lines 
36-44, see col. 11, lines 65 to col. 12, lines 5); 

forwarding if the group of information is part of the one or more recorded traffic 
flows (see FIG. 8, S46, S50; see FIG. 12, S176; see col. 3, line 4-10, see col. 10, lines 24- 
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32; note that once the flow is identified and the address is resolved, the IP packet is 
forwarded according to the created/updated designated flow). 

Neither Hegde f 875 nor McKee'659 explicitly disclose incrementing a field in an 
existing entry in the table; and time stamping the group of information. 

However, the above-mentioned claimed limitations are taught by Dietz'099. In 
particular, Dietz'099 teaches incrementing a field (see col. 24, lines 55-56, see col. 14, lines 
54-56; a packet count in the counters, and note that when counting, the data must be 
incremented) in an existing entry in the table (see FIG. 3, Flow entry database) if the 
group of information is part of the one or more recorded traffic flows (see FIG. 3, steps 316 
and 322; see col. 14, lines 3-35, 48-57; see col. 24, lines 50-59; note that when the packet is 
found to have a match flow-entry in the database 324, the calculator enters the measured 
statistical data in the flow-entry); and 

time stamping the group of information (see col. 20, line 40-65; note that the time 
stamps are generated, collected, and analyzed for each packet of the flow). 

In view of this, having the combined system of Hegde'875 and McKee , 659, then 
given the teaching of Dietz'099, it would have been obvious to one having ordinary skill in 
the art at the time the invention was made to modify the combined system of Hegde'875 and 
McKee'659, for the purpose of providing a mechanism of collecting traffic flows in the flow- 
entry database by utilizing counters, and time stamping the packet, as taught by Dietz'099, 
since Dietz'099 states the advantages/benefits at col. 4, lines 40 to col. 5, lines 10 that it 
would recognize and classify all flows that pass either direction of the network and tune the 
performance of the network. The motivation being that by collection the traffic flow 
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information, it enhance the performance of the network since the resources are being 
monitored and occurrences of specific sequences of packets are being reported. 



4. Claim 7,8,14,15,21, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hegde'875, McKee'659 and Dietz'099, as applied to claim 6 above, and further in view of 
Takase (U.S. 5,822,535). 

Regarding claim 7, 14 and 21, the combined system of Hegde'875, McKee'659 and 
Dietz'099 discloses the processing of the group of information for network data collection as 
described above in claims 1 and 6. Hegde , 875 further discloses a network traffic data 
collection application (see FIG. 2, Flow Table 70). Dietz'099 also discloses a network traffic 
data collection application (see FIG. 11, Lookup/update Engine DUE 1 107). 

Neither Hegde'875, McKee'659 nor Dietz'099 explicitly disclose creating a traffic 
information packet; and transmitting the traffic information packet. 

However, the above-mentioned claimed limitations are taught by Takase'535. In 
particular, Takase'535 teaches creating a traffic information packet (see FIG. 17B, Response 
Packet; see coL 2, lines 55-61; see col. 20, lines 5-30; see FIG. 7, Steps S5-S7; note that 
upon receiving the call/request packet 401 from the management node 100, the 
managed node 301 creates a response packet after collecting and accumulating 
according to the inquiry); and 

transmitting the traffic information packet to a network traffic data collection 
application (see FIG. 2, software application Management system 400 of the 
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Management node 100; see FIG. 7, S8; the response packet is transmitted to the 
software application management system 400; see col. 7, lines 50 to col. 9, lines 6). 

In view of this, having the combined system of Hegde'875, McKee'659 and 
Dietz'099, then given the teaching of Takase'535, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify the combined system of 
Hegde'875, McKee'659 and Takase'535, for the purpose of providing a mechanism of 
transmitting a collected response packet to the collection management application system 
upon inquiry, as taught by Takase f 535, since Takase'535 states the advantages/benefits at col. 
2, lines 45 to col. 3, lines 40 that it would reduce the amount of traffic flow in the network by 
preventing concentration of network load. The motivation being that by transmitting 
collected response packet only upon request to the management software application, it can 
reduce the network congestion since the collected packet is transmitted only upon request. 

Regarding claim 8, 15 and 22, Takase'535 discloses wherein the traffic information 
packet comprises a header (see FIG. 17B, Protocol Header 171) and one or more flow 
records (see FIG. 17B, Attribute Value); see col. 20, lines 5-42. 

In view of this, having the combined system of Hegde'875, McKee'659 and 
Dietz'099, then given the teaching of Takase'535, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify the combined system of 
Hegde'875, McKee'659 and Takase'535, for same purpose as described above in claims 7,14, 
and2L 
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5. Claims 23 and 27 rejected under 35 U.S.C. 103(a) as being unpatentable over Hegde f 875 and 
McKee'659, and further in view of Hebb (U.S. 6,463,067). 

Regarding claim 23, Hegde'875 discloses an apparatus (see FIG. 2, Multiprotocol 
Switch 40) for collecting network traffic data comprising: 

one or more route processors (see FIG. 2, CPU 80); 

one or more switch fabrics (see FIG. 2, Switch Module 60) coupled to the one or 
more route processors (see FIG. 2, Switch module 60 is connected to CPU 80); 

one or more destination line cards (see FIG. 1 and 2, transmitting ports of the 
Input/output ports 50-1... 50-N which interface with network nodes, also each port must 
he on the card) coupled to the one or more switch fabrics (see FIG. 2, Input/output ports 
50 is connected to Switch Module 60; see col. 4, lines 34-53); 

a source line card (see FIG. 1 and 2, receiving ports of the Input/output ports 50- 
1...50-N which interface with network nodes, also each port must he on the card) 
coupled to the one or more switch fabrics (see FIG. 2, Input/output ports 50 is connected 
to Switch Module 60; see col. 4, lines 34-53), 

wherein the source line card receive a group of information (see FIG. 2, receiving 
ports of Input/output ports 50 receive IP packet; see col. 4, lines 34-53, see FIG. 7, S30 
and S32; see col. 8, lines 250 to col. 9, lines 390); 

Determine whether to process the group of information for network data collection 
(see FIG. 8, S42, S44; see col. 2, lines 65 to col. 3, lines 9; see col. 9, lines 40-55; note that 
IP header is extracted and determined if the flow (i.e. source and destination) is in the 
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flow table for updating/creating the new forwarding information in the flow table 70 
(also see FIG. 5)); 

process the group of information for network data collection if the determination is to 
process the group of information (see FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, lines 
36-44, see col. 11, lines 65 to col. 12, lines 5; note that the new forwarding information is 
created in the flow table when the flow from extracted IP header is not in the flow 
table; also see FIG. 10 for recording/collecting the entries in the flow table); and 

forward the group of information to the destination (see FIG. 8, S46, S50; see col. 3, 
line 4-10, see col. 10, lines 24-32; note that once the flow is identified and the address is 
resolved, the IP packet is forwarded to the destination); 

Hegde'875 does not explicitly disclose collection according to a sample algorithm. 

However, the above-mentioned claimed limitations are taught by McKee'659. In 
particular, McKee'659 teaches network data collection according to a sample algorithm (see 
FIG. 6, a method/algorithm which collects network traffic data (i.e. a monitoring 
system which randomly collects the traffic data from the sample packets, thus, it is a 
sample method); see col. 1, lines 13-24, see col. 2, lines 67 to col. 3, lines 16). 

In view of this, having the system of Hegde'875 and then given the teaching of 
McKee'659, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify the system of Hegde'875, for the purpose of providing a 
network data monitoring and collection method on sample packets, as taught by McKee'659, 
since McKee'659 states the advantages/benefits at col. 3, lines 5-39 that it would facilitate the 
identification of significant data items relevant to management of a network. The motivation 
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being that by monitoring and collection data, it can increase the network performance since 
the system is able to collect data regarding the network and path configuration, provisioning, 
routing, forwarding for future use, and to identify any potential problems in the network. 

Neither Hegde'875 nor McKee'659 explicitly discloses the source line card (see 
Hebb'067 FIG. 2, a line interface unit PHY I/O and Framing 20 unit) process the group 
of information (see Hebb'067 FIG. 2, Forwarding Engine 22 within interface card 20 
processes the received packets by segmenting and forwarding them toward the switch 
fabric 16; see cHebb'067 col. 3, lines 55-60), and 

forward the group information to one or more destination line cards (see McKee'659 
FIG. 2, another PHY I/O and Framing 20 unit; note that a segmented packet is send 
from switch fabric 16 to outgoing line interface PHY I/O and Framing 20 unit, and then 
the received segments are reassembled into packets for outgoing transfers; see col. 3, 
lines 50-62). 

However, the above-mentioned claimed limitations are taught by Hebb'067. In view 
of this, having the combined system of Hegde'875 and McKee'659, then given the teaching 
of Hebb'067, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify the combined system of Hegde'875 and McKee'659, for the 
purpose of providing processing packets within input line interface unit and sending the 
processed data to outgoing line interface unit, as taught by Hebb'067, since Hebb'067 states 
the advantages/benefits at col. 2, lines 25-54 that it would enhance the efficiency and speed 
of the communication between the packet process and the forwarding engine, and allowing 
for high-speed packet forwarding and classification. The motivation being that by processing 
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the packet at the incoming port and forwarding to the switch fabric and the outgoing port, it 
can increase the performance of the network and enhance the packet classification since the 
packet is proceed at incoming port before traversing the router. 

Regarding claim 27, Hebb'067 discloses wherein the one or more processing engines 
(see FIG. 2, Forwarding Engine 22) is located on the source line card (see Hebb'067 FIG. 
2, a line interface unit PHY I/O and Framing 20 unit; note that Forwarding Engine 22 
within interface card 20; col. 3, lines 55-60). 

In view of this, having the combined system of Hegde'875 and McKee'659, then 
given the teaching of Hebb'067, it would have been obvious to one having ordinary skill in 
the art at the time the invention was made to modify the combined system of Hegde'875 and 
McKee'659, for the same purpose as described above in claim 23. 

6. Claim 28 is rejected under 35 U.S.C. 103(a) as being unpatentable over Hegde'875, 

McKee'659 and Hebb'067, as applied to claim 23 above, and further in view of Dietz (U.S. 
6,651,099). 

Regarding claim 28, Hegde'875 discloses determining if the group of information is 
part of one or more recorded traffic flows (see FIG. 8, S42, S44; see col. 2, lines 65 to col. 3, 
lines 9; see col. 9, lines 40-55; note that IP header is extracted and determined if the 
traffic flow is in the flow table); 

creating a new entry in a table if the group of information is not part of the one or 
more recorded traffic flows (see FIG. 8, S56; Forwarded to CPU for processing; col. 3, 
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lines 2-6; note that when there is no entry of a flow in the flow table, the packet is 
forwarded to CPU to be processed. See FIG. 9, S88, S90, S94; the CPU updates the 
table with a new traffic flow; see FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, lines 
36-44, see col. 11, lines 65 to col. 12, lines 5); 

forwarding if the group of information is part of the one or more recorded traffic 
flows (see FIG. 8, S46, S50; see FIG. 12, S176; see col. 3, line 4-10, see col. 10, lines 24- 
32; note that once the flow is identified and the address is resolved, the IP packet is 
forwarded according to the created/updated designated flow). 

Neither Hegde'875 nor McKee , 659 explicitly disclose incrementing a field in an 
existing entry in the table; and time stamping the group of information. 

However, the above-mentioned claimed limitations are taught by Dietz'099. In 
particular, Dietz'099 teaches incrementing a field (see col. 24, lines 55-56, see col. 14, lines 
54-56; a packet count in the counters, and note that when counting, the data must be 
incremented) in an existing entry in the table (see FIG. 3, Flow entry database) if the 
group of information is part of the one or more recorded traffic flows (see FIG. 3, steps 316 
and 322; see col. 14, lines 3-35, 48-57; see col. 24, lines 50-59; note that when the packet is 
found to have a match flow-entry in the database 324, the calculator enters the measured 
statistical data in the flow-entry); and 

time stamping the group of information (see col. 20, line 40-65; note that the time 
stamps are generated, collected, and analyzed for each packet of the flow). 

In view of this, having the combined system of Hegde'875 and McKee'659, then 
given the teaching of Dietz'099, it would have been obvious to one having ordinary skill in 
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the art at the time the invention was made to modify the combined system of Hegde'875 and 
McKee'659, for the purpose of providing a mechanism of collecting traffic flows in the flow- 
entry database by utilizing counters, and time stamping the packet, as taught by Dietz'099, 
since Dietz'099 states the advantages/benefits at col. 4, lines 40 to col. 5, lines 10 that it 
would recognize and classify all flows that pass either direction of the network and tune the 
performance of the network. The motivation being that by collection the traffic flow 
information, it enhance the performance of the network since the resources are being 
monitored and occurrences of specific sequences of packets are being reported. 

7. Claims 29 and 30 are rejected under 35 U.S.C. 103(a) as being unpatentable over Hegde'875, 
McKee'659, Hebb'067 and Dietz'099, as applied to claim 28 above, and further in view of 
Takase (U.S. 5,822,535). 

Regarding claim 29, the combined system of Hegde'875, McKee'659, Hebb'067 and 
Dietz'099 discloses the processing of the group of information for network data collection as 
described above in claims 1 and 6. Hegde'875 further discloses a network traffic data 
collection application (see FIG. 2, Flow Table 70). Dietz'099 also discloses a network traffic 
data collection application (see FIG. 11, Lookup/update Engine LUE 1 107). 

Neither Hegde'875, McKee'659, Hebb'067, nor Dietz'099 explicitly disclose creating 
a traffic information packets and transmitting the traffic information packet. 

However, the above-mentioned claimed limitations are taught by Takase'535. In 
particular, Takase'535 teaches creating a traffic information packet (see FIG. 17B, Response 
Packet; see col. 2, lines 55-61; see col. 20, lines 5-30; see FIG. 7, Steps S5-S7; note that 
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upon receiving the call/request packet 401 from the management node 100, the 
managed node 301 creates a response packet after collecting and accumulating 
according to the inquiry); and 

transmitting the traffic information packet to a network traffic data collection 
application (see FIG. 2, software application Management system 400 of the 
Management node 100; see FIG. 7, S8; the response packet is transmitted to the 
software application management system 400; see col. 7, lines 50 to col. 9, lines 6). 

In view of this, having the combined system of Hegde'875, McKee'659, Hebb'067 
and Dietz'099, then given the teaching of Takase'535, it would have been obvious to one 
having ordinary skill in the art at the time the invention was made to modify the combined 
system of Hegde'875, McKee'659, Hebb'067 and Dietz'099, for the purpose of providing a 
mechanism of transmitting a collected response packet to the collection management 
application system upon inquiry, as taught by Takase'535, since Takase'535 states the 
advantages/benefits at col. 2, lines 45 to col. 3, lines 40 that it would reduce the amount of 
traffic flow in the network by preventing concentration of network load. The motivation 
being that by transmitting collected response packet only upon request to the management 
software application, it can reduce the network congestion since the collected packet is 
transmitted only upon request. 

Regarding claim 30, Takase'535 discloses wherein the traffic information packet 
comprises a header (see FIG. 17B, Protocol Header 171) and one or more flow records (see 
FIG. 17B, Attribute Value); see col. 20, lines 5-42. 
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In view of this, having the combined system of Hegde'875, McKee'659, Hebb'067 
and Dietz'099, then given the teaching of Takase'535, it would have been obvious to one 
having ordinary skill in the art at the time the invention was made to modify the combined 
system of Hegde'875, McKee'659, Hebb'067 and Dietz'099, for same purpose as described 
above in claims 7,14, and 21 . 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ian N Moore whose telephone number is 703-605- 1 53 1 . The 
examiner can normally be reached on M-F: 9-5. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ken Vanderpuye can be reached on 703-308-7828. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306, 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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